Wednesday, May 22, 2024

Millions of Routers are Actively Exploited Through Bypasses Authentication Bug

The security researcher at the information security company Tenable Evan Grant detected that a serious security violation puts millions of routers at risk all over the world.

According to the report of a security analyst, this is a critical vulnerability that circumvents the authentication and attacks the home devices that are using Arcadyan firmware. 

However, this attack generally enables the threat actors to control them and to implement the attacks utilizing the Mirai botnet.

Millions of Routers Are Vulnerable

After investigating the attack, the security analysts came to know that this vulnerability has attacked millions of routers models from different merchants and ISPs, that also includes:- 

  • Asus
  • British Telecom
  • Deutsche Telekom
  • Orange
  • O2 (Telefonica)
  • Verizon
  • Vodafone
  • Telstra
  • Telus

The security vulnerability has been detected by the Tenable, which is tracked as “CVE-2021-20090” with a CVSS score of 9.9 and after detecting the attack they published about it on April 26, not only this, recently, the experts have also provided some proof of concept exploit code.

However, the cybersecurity experts have studied the matter clearly, and based on the number of routers as well as the merchants that are infected by this vulnerability attack are increasing rapidly and went to millions, that’s why the experts are trying their best to detect all the infected devices.

Attack Details

After investigating the security experts came to know that the attack was started from the IP address 27.22.80[.]19 over HTTP. Moreover, the attackers have modified the configuration of all the attacked devices, and it allows the Telnet to utilize “ARC_SYS_TelnetdEnable=1”.

Once it does, after that it moves to download a new script from the IP address 212.192.241[.]72 utilizing either wget or curl and then administers the whole operation that they have planned.

List of all known affected devices and vendors 

The security experts have mentioned the full list of the affected devices and vendors, and here below we have mentioned an image in which the full list is mentioned:-

Attacks start two days later the PoC exploit release

The most interesting point is that the security lab Juniper Threat has detected some attack patterns that are trying to exploit this vulnerability and after investigating it the analysts came to know that it was coming from IP addresses that are initially located in Wuhan, Hubei province, China.

However, in this attack, the cybercriminals are using some malicious tools so that they can deploy a Mirai botnet variant, and it is quite similar to those which were used in a Mirai campaign that is targeting IoT and network security devices.

In both the attacks, there are some similarities, and the researchers stated that after studying the similarities it indicates that the threat actors that are behind these attacks are the same.

However, to know the exact details of these attacks, the security analysts are investigating the whole matter, and they have claimed that they will soon disclose the details of this attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates.


Latest articles

Hackers Claiming Access to Qatar National Bank Database

A group of hackers has claimed to have accessed the database of Qatar National...

Cloud-Based Malware Attack Abusing Google Drive & Dropbox

A phishing email with a malicious zip attachment initiates the attack. The zip contains...

OmniVision Technologies Cyber Attack, Hackers Stolen Personal Data in Ransomware Attack

OmniVision Technologies, Inc. (OVT) recently disclosed a significant security breach that compromised its clients'...

Critical Flaw In Confluence Server Let Attackers Execute Arbitrary Code

The widely used team workspace corporate wiki Confluence has been discovered to have a...

Threat Actors Leverage Bitbucket Artifacts to Breach AWS Accounts

In a recent investigation into Amazon Web Services (AWS) security breaches, Mandiant uncovered a...

Hackers Breached Western Sydney University Microsoft 365 & Sharepoint Environments

Western Sydney University has informed approximately 7,500 individuals today of an unauthorized access incident...

Memcyco Report Reveals Only 6% Of Brands Can Protect Their Customers From Digital Impersonation Fraud

Memcyco Inc., provider of digital trust technology designed to protect companies and their customers...
BALAJI is an Ex-Security Researcher (Threat Research Labs) at Comodo Cybersecurity. Editor-in-Chief & Co-Founder - Cyber Security News & GBHackers On Security.

Free Webinar

Live API Attack Simulation

94% of organizations experience security problems in production APIs, and one in five suffers a data breach. As a result, cyber-attacks on APIs increased from 35% in 2022 to 46% in 2023, and this trend continues to rise.
Key takeaways include:

  • An exploit of OWASP API Top 10 vulnerability
  • A brute force ATO (Account Takeover) attack on API
  • A DDoS attack on an API
  • Positive security model automation to prevent API attacks

Related Articles